Data Processing Agreement (DPA)

1. Parties and roles

The customer is the data controller and Salvus is the processor. Salvus processes personal data only on documented instructions from the customer, unless required otherwise by law.

2. Subject matter and duration

The processing concerns the provision of the Occupational Health & Safety platform and lasts for the duration of the subscription, including the retention period and the return or deletion of data.

3. Nature of the data

The data processed relates to workers covered by the customer's services, including identification data, role, training and health data on fitness for work (special category).

4. Salvus's obligations

Salvus ensures confidentiality, applies appropriate technical and organisational measures, assists the customer in meeting its obligations and provides information to demonstrate compliance.

5. Sub-processors

Salvus engages: (a) Supabase Inc. — primary database in the EU region, authentication and storage; (b) Vercel Inc. — application hosting, delivery and cookieless technical metrics; (c) Resend Inc. — transactional email, including customer-configured operational OHS communications; (d) Google LLC — Google Calendar and Google Meet when the integration is enabled, receiving only the invitation data required (type, time, organisation, participant name and email); (e) Google Analytics and PostHog — analytics only after consent, when configured; and (f) the AI provider selected in the active configuration — OpenRouter, Groq, Google Gemini, NVIDIA, Anthropic or OpenAI — to process the context required for the requested feature. Salvus applies data minimisation and does not deliberately send individual clinical records to AI providers. The customer is notified of material changes and may object on legitimate grounds.

6. International transfers

The primary database is hosted in Supabase's EU region. Some supporting, calendar, analytics and AI services may process data outside the European Economic Area. In those cases Salvus uses the applicable transfer mechanism, including adequacy decisions and/or Standard Contractual Clauses under GDPR Article 46, and limits data to the service purpose. Enabling Google Calendar/Meet and AI providers must follow the instructions and configuration agreed with the customer.

7. Data breaches

Salvus notifies the customer without undue delay after becoming aware of a personal data breach, providing the information needed for the customer to meet its notification duties.

8. Return and deletion

On termination of the contract, and at the customer's choice, Salvus returns or deletes the personal data, unless legally required to retain it.

9. Audit

Salvus makes available the information reasonably necessary to demonstrate compliance with this agreement and allows for audits as agreed between the parties.

10. Medical certification boundary

Salvus is an occupational health and safety management platform, not a medical device or healthcare provider. The platform stores and organises data produced by licensed professionals (occupational physicians, certified SST technicians) operating under Lei n.º 102/2009 and the Ordem dos Médicos. Fitness verdicts, clinical card entries and aptitude certificates must be issued exclusively by qualified professionals. The platform does not autonomously generate medical diagnoses or fitness determinations. AI-assisted features (risk autofill, report drafting, deadline triage) operate on structural SST data only and do not constitute medical advice. Customers are solely responsible for ensuring their professionals hold the required certifications under Portuguese law.